CVE-2026-24042

The application exposes a POST /api/v1/actions/execute endpoint that handles a viewMode parameter. Sending viewMode=false or omitting this parameter by an unauthenticated user causes the action to be executed in edit mode instead of only published actions. The access control mechanism does not properly verify whether the requesting user has permissions to run unpublished queries and API actions, which constitutes a violation of the expected boundary between edit mode and public viewing mode (CWE-862 — missing authorization).

An attacker can gain access to sensitive data, execute unpublished queries and API calls in edit mode, access developer data, and trigger unwanted side effects defined in application actions.

According to information available at the time of publication, no released patch exists yet. You should monitor vendor references (https://github.com/appsmithorg/appsmith/security/advisories/GHSA-j9qq-4fj9-9883) and apply the patch immediately after it becomes available. Until a patch is released, it is recommended to restrict public access to the Appsmith application and implement access controls at the network level (firewall, VPN).

Appsmith in versions 1.94 and lower, in case of applications configured as publicly accessible.